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Norwegian  data 
legislation  and 
research. 


Implications  for  data 
access,  data  collection  and 
data  archiving. 


1974,  dealt  with  information 
handling,  especially  credit 
reporting,  in  private 
enterprise.  ^  A  second 
committee  was  established  in 
1972  to  study  the  uses  and 
possible  misuses  of 
personal-level  registers  in  the 
public  sector.  In  1975,  this 
latter  committee  reported  to 
the  Ministry  of  Justice, 
recommending  the  introduction 
of  legislation  similar  to  the 
Swedish  Data  Law  introduced  two 
years  earlier^.  The  subsequent 
process  of  hearings  and 
consultations  took  more  than 
two  years  and  resulted  in  a 
joint  bill  covering  both  the 
private  and  public  sectors.  The 
bill  was  submitted  to 
Parliament  in  the  fall  of  1977, 
and  the  final  Personal  Data 
Registers  Act  was  passed  by  the 
Storting  in  June  1978*.  The 
main  features  of  the  Act  can  be 
summarized  as  follows: 


by  Thore  Gaard  Olaussen 


I nt  r  oduct  i  on 


The  Norwegian  Personal  Data 
Registers  Act  took  effect  on 
January  1,  1980,  following  a 
period  of  clarification, 
reports,  hearings,  and 
consultations.  Almost  a  decade 
earlier,  the  first  committee 
had  been  established  to  review 
the  use  of  personal  information 
in  modern  society.  This 
committee,  working  from  1971  to 

'  This  article  is  based  on  a 
paper  presented  at  the  lASSIST 
'84  conference,  Ottawa,  May 
14-18,  1984. 


1.   A  Data  Inspectorate  handles 
all  applications  for 
concession  to  establish 
registers  of  personal  data, 
and  also  controls  the  use 


^  Its  report  was  submitted  to 
the  Ministry  of  Justice  in 
April  1974.  Persondata  og 
personvern  (Personal  data  and 
privacy),  NOU  1974:22.  Oslo: 
Universitetsforlaget . 
^  Ministry  of  Justice. 
Of f entliqe  persondata system  og 
personvern  (Public  person  data 
systems  and  privacy).  NOU 
1975:10.  Oslo: 
Universitetsforlaget. 
"For  more  details  seee  Jon  Bing 
Sc  Knut  S.  Selmer  (eds.),  A 
decade  of  computers  and  law. 
Oslo:  Universitetsforlaget, 
1980.  See  especially  the 
chapter  by  Knut  S.  Selmer 
"Norwegian  privacy 
legislation. " 
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of  such  registers. 

In  addition  to  covering  all 
registers  set  up  for 
electronic  processing,  the 
law  requires  application 
for  concession  also  for 
manually  operated 
registers,  if  these  are  to 
incorporate  sensitive 
information  (such  as 
information  on  political  or 
religious  beliefs,  criminal 
records,  state  of  health, 
abuse  of  intoxicants, 
sexual  habits,  etc.). 

An  application  for 
concession  must  specify 
what  information  the 
register  will  include.  The 
letter  of  concession 
specifies  the  allowable 
uses  of  the  register  and, 
if  necessary,  specifies 
which  types  of  data, 
mentioned  in  the 
application,  are  not 
included  in  the  concession. 

All  citizens  have  the  right 
to  request  and  receive 
information  about  the  data 
concerning  themselves 
stored  in  such  registers. 
This  right  does  not, 
however,  apply  to  data 
registers  "which  are  only 
used  for  statistical, 
research,  or  general 
planning  purposes"^. 

The  law  also  requires 
specific  concessions  be 
obtained  for  conducting 
opinion  and  market  surveys, 
and  stipulates  that  any 
identifying  data,  such  as 
personal  identification 
number  or  name,  must  be 
destroyed  after  six  months. 


unless  explicit  permission 
to  keep  such  information 
has  been  obtained  from  the 
persons  concerned. 

6.   And,  finally,  the  law 

stipulates  that  registers 
of  personal  data  cannot  be 
transferred  abroad  without 
the  explicit  permission  of 
the  Data  Inspectorate. 

The  decisive  point  in  the 
definition  of  'person  register' 
is  whether  or  not  the 
information  identifies 
individuals  directly  or 
indirectly,  regardless  of 
whether  the  data  are  stored  in 
a  computer  file  or  a  manual 
file.  Compared  to  legislation 
in  other  countries,  such  as 
Sweden,  this  is  a  unique 
feature  of  the  Norwegian  Data 
Law.  The  Swedish  Data  Law 
regulates  only  computerized 
data . 

Another  important  feature 
of  the  Norwegian  data  law  is 
that  it  applies  the  concept  of 
'person'  in  the  legal  sense. 
This  includes  not  only  physical 
persons,  but  also  enterprises, 
organizations,  foundations, 
etc . 


Cons  e  que  nee  s    for    research 
act  i  vi  t  y 


^Section  7,  paragraph  1  in  the 
Data  Law. 


Submission 
for  concess 
research  pr 
of  resource 
Inspectorat 
deal  with  t 
application 
registers  i 
private  sec 
arrival  of 
application 
new  registe 


of  an  application 
ion  may  delay  the 
ocess.  Due  to  lack 
s,  the  Data 
e  had  not  managed  to 
he  great  number  of 
s  for  existing 
n  the  public  and 
tors,  before  the 
the  first 

s  for  establishing 
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bottleneck  exists  in  the 
system.  In  some  cases, 
applications  from  research 
programs  may  take  only  a  couple 
of  weeks  to  process.  In  other 
cases,  it  may  take  up  to  half  a 
year  before  the  researcher 
receives  the  letter  of 
concession.  Before  s/he 
receives  this  letter,  the 
researcher  is  not  permitted  to 
establish  the  register. 

Many  of  the  registers 
being  established  in  medical, 
psychological,  or  sociological 
research  programs,  for  example, 
contain  the  kind  of  sensitive 
information  specifically 
mentioned  in  the  law.  Normally, 
researchers  require  quick 
access  to  such  information. 
According  to  the  law,  however, 
the  Data  Inspectorate  can 
impose  special  restrictions  on 
the  collection  of  such 
information.  When  information 
is  sensitive,  the  Data 
Inspectorate  may  want  to  impose 
more  than  normally  restrictive 
conditions,  out  of  concern  for 
privacy  protection.  These 
restrictions  may  make  it  very 
difficult  to  collect  data  and 
make  them  available  on  time. 

The  law  makes  no 
distinction  between  the  use  of 
data  for  research  purposes  and 
the  administrat  ive  use  of  data. 
This  means  that  the  Data 
Inspectorate  is  not  obliged  to 
take  the  purpose  of  the  data 
collection  into  account  when 
considering  applications  for 
concession . 

The  Norwegian  Social 
Science  Data  Services  (NSD)  has 
repeatedly  emphasized  the 
difference  between  data  for 
research  use  and  the 
administrative  use  of  data.  The 
research  community  has 
identified  and  stressed  the 
important  characteristics  of 
the  research  process  and 


statistical  production  which 
distinguish  research  use  of 
data  from  administrative 
management . 

1.   trends  only  will  be 
analyzed  by  means 
of  techniques  such 
as 

cross- tabulations, 
correlations  and 
other  summary 
statistics;  -  these 
are  techniques 
which  prevent  the 
identification  of 
individuals; 


personal  data  may 
be  collected  and 
analyzed  either 
continually  or 
repeatedly  at 
irregular 
intervals; 


each  phase  of 
analysis  will  be 
comparatively  short 
as  compared  to  an 
established 
administrative 
register ) ,  i.e. 
often  no  longer 
than  a  year; 


the  number  of 
researchers  and 
institutions 
involved  in 
handling 
individually 
identifiable  data 
is  limited,  because 
it  is  not  the 
individual  per  se, 
but  the  attributes 
of  the  individual 
that  are  of 
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interest. * 

Usually  a  research  project 
will  last  for  a 
predetermined  period  of 
time.  So  too  does  the 
validity  of  the  concession. 
The  Data  Inspectorate  has 
made  it  clear  that  data 
concessions  granted  a 
specific  project  will  be  in 
force  only  for  the  duration 
of  the  project.  After  the 
expiry  of  the  concession 
period,  the  Data 
Inspectorate  can  instruct 
the  researcher  to  destroy 
the  data.  Obviously,  the 
imposition  of  such 
restrictions  makes  the  use 
of  such  research  methods  as 
follow-up  studies  and  panel 
studies  impossible. 


Sol  ut  i  ons 


Even  as  the 
prepared,  a 
researchers 
the  implica 
law  would  h 
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^Jarle  Broseveet  &  Orjar  Oyen, 
Norwegian  Data  Law  and  the 
Social  sciences,  paper  prepared 
for  the  CESSDA/IFDO  conference 
on  'Emerging  data  protection 
and  the  social  sciences'  need 
for  access  to  data',  Cologne, 
August  9-11,  1978. 


execution  of  studies.' 

One  of  the  concerned 
researchers  was  Stein  Rokkan^ 
who  advised  the  Norwegian 
Research  Council  for  Science 
and  the  Humanities  (NAVF)  to 
take  action  to  protect  the 
researcher's  right  to  access  to 
information  as  regulated  under 
the  new  law.  Social  science 
researchers  in  particular  began 
a  series  of  discussions  to  find 
workable  solutions  to  the 
various  problems  facing 
research  activity  requiring 
micro  data.  At  the  suggestion 
of  NSD,  among  others,  the  Board 
of  the  Norwegian  Research 
Council  for  Science  and  the 
Humanities  decided  to  establish 
a  Secretariat  for  Data 
Protection  affairs.  The 
Secretariate,  which  was 
established  at  the  Norwegian 
Social  Science  Data  Services 
(NSD)  in  Bergen,  began 
negotiations  with  the  Data 
Inspectorate  during  the  early 
spring  of  1 981 . 

The  Research  Council  felt 
that  two  major  issues  required 
clarification.  The  first  was  to 
ensure  that  the  measures  taken 
to  protect  the  individual's 
right  of  privacy  would  not 
seriously  prevent  scientists 
from  using  individual-level 
data.  The  Research  Council 
agreed  to  report  regularly  to 
the  Data  Inspectorate  research 


'See  especially  Tore  Dalenius 
and  Anders  Kelevmarken  (eds.)/ 
Personal  integrity  and  the  need 
for  data  in  the  social 
sciences.  Stockholm:  Swedish 
Council  of  Social  Science 
Research,  1976. 
^See  Stein  Rokkan,  'The 
production,  linkup  and 
communication  of  social  science 
data:  a  survey  of  developments 
in  Norway.  '  draft,  Bergen  1977 
(unpublished) . 


projects  that  needed  concession 
under  the  law.  A  letter  of 
recommendation  from  the  NSD 
should  be  enclosed  with  each 
application  forwarded. 

The  other  major  issue 
stressed  by  the  Research 
Council  was  the  need  to 
establish  a  system  to  archive 
data  files  upon  termination  of 
a  research  project.  The  Council 
suggested  the  establishment  of 
a  system  whereby  the 
Secretariat  could  store  the 
data  for  possible  later 
reanalysis.  However,  a  number 
of  questions  had  to  be 
clarified  before  arriving  at 
this  solution.  Initially,  the 
Data  Inspectorate  was  not 
sympathetic  to  the  question  of 
data  archiving.  According  to 
the  law,  data  containing 
personal  identification  was  to 
be  destroyed.  In  the  end,  an 
agreement  was  reached  which 
allowed  researchers  to  retain 
data  when  "there  are  reasons 
for  presuming  them  useful  in 
future  research,..."'.  This 
agreement  was  accepted  with 
certain  precautions.  Firstly,  a 
commission,  appointed  by  the 
Research  Council  is  empowered 
to  decide  which  data  are  to  be 
kept  in  archives  and  which  are 
to  be  destroyed.  Secondly,  data 
files  must  be  transferred  to 
special  archival  institutions 
recognized  by  the  Data 
Inspectorate.  And  thirdly,  no 
data  may  be  transferred  if  the 
transfer  is  inconsistent  with 
the  ethics  of  secrecy. 

How  such  transfer  might  be 
inconsistent  with  secrecy  norms 
was  not  specified,  and  has  been 
a  matter  of  discussion  ever 
since.  A  report  from  a 


'The  general  concession  for 
research  projects  financed  by 
NAVF,  Oslo,  April  24,  1981, 
paragraph  4.9. 


committee  appointed  by  the 
Research  Council  has  now  made 
it  clear  that  data  transfer  to 
a  data  archiving  institution 
usually  will  not  imply  conflict 
with  the  provisions  of  ethical 
secrecy.  The  Data  Inspectorate 
was  represented  on  the 
committee  and  accepted  this 
interpretation  as  valid. 


Other    data    access    regulations 


Access    to    administrative    data 


Data  handling  in  public 
administration  is  regulated  by 
a  special  law  governing 
procedures  in  public 
management.  The  same  law 
regulates  accessibility  of  data 
files  or  information  primarily 
used  for  administrative 
purposes  in  public  agencies  to 
researchers.  If  a  researcher 
needs  access  to  micro-level 
information,  and  if  this 
information  is  subject  to 
ethical  secrecy,  he  must  obtain 
permission  from  the  Ministry, 
unless  such  permission  can  be 
obtained  from  the  individuals 
concerned.  The  researcher  must 
convince  the  Department  of  the 
usefulness  and  seriousness  of 
the  research  program,  and  that 
it  will  be  difficult  to  achieve 
the  research  goal  by  other 
means . 

In  such  cases,  the 
researcher  must  go  through  at 
least  two  steps  to  get 
permission  to  obtain  data. 
First,  an  application  must  be 
submitted  to  the  Department.  A 
special  advisory  commission  is 
appointed  to  judge  the 
application.  Then  a  new 
application  must  be  sent  to  the 
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Data  Inspectorate  for 
concession  to  establish  the 
data  register.  The  system  is 
bureaucratic  but  does  allow 
some  possibility  of  data 
access. 


The  researcher  must 
have  been  granted 
concession  by  the 
Data  Inspectorate 
before  obtaining 
the  data. 


Access    to    data   from   the 
Statistical    Agency 


The  Central  Bureau  of 
Statistics  has,  according  to 
the  Statistics  Law,  the  right 
to  obtain  data  from  citizens 
(such  as  census  data).  The 
Bureau  also  conducts  surveys. 
These  surveys  are  based  on  a 
representative  sample  of  the 
Norwegian  population.  In 
accordance  with  the  data  law, 
the  Data  Inspectorate  has 
outlined  some  general  rules 
concerning  researchers'  access 
to  these  data.  Census  data  may 
be  used  for  research  outside 
the  Bureau.  This  applies  as 
well  to  survey  data,  if 
respondents  have  consented  to 
the  data  being  used  for 
research  purposes.  But  before 
the  data  (either  census  or 
survey)  may  be  distributed, 
further  conditions  must  be 
satisfied: ^° 

1 .   The  data  should  be 
anonymized,  but  not 
to  such  an  extent 
as  to  make  the 
proposed  research 
impossible.  (It  is 
up  to  the 
researcher  to 
decide  the  degree 
of  anonymization .  ) 


'°The  Concession  for  the 
Central  Bureau  of  Statistics, 
Oslo,  April  2,  1981,  paragraph 
4.3  first  point. 


3.   The  data  shall  be 
used  for 
statistical 
analysis  only. 

The  regulations  on  access 
to  survey  data  may  have 
some  negative  effects.  It 
is  quite  cumbersome  to 
obtain  consent  for 
reanalysis  from  ■ 
respondents.  The  outcome 
may  be  that  no  one  wants  to 
use  the  data.  Further, 
obtaining  consent  may  lead 
to  a  dramatic  decline  in 
the  number  of  respondents. 
This  may  affect  the 
representativeness  of  the 
sample.  For  the  researcher, 
these  conditions  may  be 
serious  impediments  to 
gaining  access  to  survey 
data;  and  many  feel  that  it 
is  unreasonable  to  be 
forced  to  obtain  the 
consent  of  respondents  in 
order  to  use  anonymized 
data . 

However,  the 
cooperation  of  the  Central 
Bureau  of  Statistics  is 
very  important  to  the 
research  community.  The 
Bureau  offers  a  number  of 
services  to  researchers  - 
from  sampling  the 
population  to  conducting 
the  whole  survey.  For 
services  such  as  these, 
however,  payment  is 
required,  and  for  many 
researchers,  may  be  too 
expensive. 

Therefore,  cooperation 
has  been  established 
between  the  Bureau  and  the 


NSD.  NSD  can  acquire 
anonymized  survey  data  and 
make  them  available  for 
research  purposes.  This 
arrangement  does  not  not 
imply  departure  from  the 
regulations  imposed  by  the 
Data  Inspectorate.  The  data 
are  totally  anonymized 
before  being  transfered 
from  the  Bureau  to  the  NSD. 
Nor  may  either  the  NSD  nor 
the  researcher,  have  input 
to  the  degree  to  which  the 
data  are  anonymized  (cf. 
condition  no.  1  above). 
Access  to  anonymized  data 
is  not  regulated  by  the 
Data  Inspectorate. 


Conclusions    -    future    aspects 


The  agreements  reached  between 
the  Data  Inspectorate  and  the 
Research  Council  and  the  Bureau 
of  Statistics  have  clarified 
'the  rules  of  the  game'.  In 
many  respects  the  agreements 
follow  the  ordinary  procedures 
as  far  as  application  for 
concession  is  concerned.  But 
there  are  also  some 
differences.  The  application 
form  itself  is  more  relevant 
for  data  processing  in  academic 
research  and  statistics. 
Further,  the  agreement  with  the 
Research  Council  implies  that 
the  Secretariate  for  data 
protection  affairs,  established 
by  the  NAVF ,  is  given  a 
mediatorial  role.  In  practice, 
this  way  of  organizing  the 
relationships  with  the  Data 
Inspectorate  gives  the  research 
community  better  means  of 
communication  with  the 
Inspectorate  than  have 
applicants  from  other  sectors. 

At  present  the  Data 
Inspectorate  has  an 


administrative  staff  of  8-9 
persons,  most  of  whom  have  a 
background  in  law.  The  Board  of 
the  Inspectorate  is  composed  of 
a  majority  of  high-ranking 
administrators  from  the  public 
and  private  sectors,  mainly 
with  law  and  technical 
expertise.  The  chairman  is 
Professor  Knut  S.  Selmer  of  the 
Faculty  of  Law,  University  of 
Oslo.  Professor  Selmer  was  also 
chairman  of  the  committee  which 
prepared  the  report  on  the 
protection  of  personal  data 
used  for  scientific  research 
and  statistics  for  the  Council 
of  Europe.  This  report 
recommends  principles  and 
guidelines  that  the  governments 
of  each  member  state  may  use  as 
the  basis  for  domestic 
law-making  and  practices 
concerning  the  use  of  personal 
data  for  scientific  research. 
As  a  member  state,  Norway  has 
accepted  the  recommendations  of 
the  report.  These 
recommendations  deal  with  a 
number  of  issues  of 
considerable  important  for 
sciencific  research,  as 
illustrated  by  the  statements 
that  follow. 

The  first  of  these 
statements  declares  that 
respect  for  privacy  must  be 
guaranteed  in  any  research 
project,  and  continues: 

'Whenever  possible, 
research  should  be 
undertaken  with 
anonymous  data. 
Scientific  and 
professional 
organizations,  as  well 
as  public  authorities, 
should  promote  the 
development  of 
techniques  and 
procedures  securing 
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anonymity. ' ' ' 

The  next  statement  focuses 
on  the  use  of  data  and  is  of 
great  importance  to  the 
research  community: 

'Personal  data 
collected  for  the 
purpose  of  a  given 
research  project  and 
with  the  consent  of  the 
persons  concerned 
should  not  be  used  in 
connection  with  another 
research  project 
substantially  different 
in  its  nature  or 
objects  from  the  first, 
except  with  the  consent 
•of  the  data  subject. 
However,  where  it  would 
be  impracticable  to 
obtain  such  consent  by 
reason  of  lapse  of  time 
or  the  large  numbers  of 
data  subjects  involved 
the  previously 
collected  data  may  be 
used  in  conformity  with 
other  safeguards  laid 
down  by  domestic 
law.' '2 

We  will  also  refer  to  a 
third  statement  concerning 
conservation  of  data,  of 
special  interest  to  data 
archiving  institutions: 

'The  consent  of  the 
persons  concerned  when 


' 'Committee  of  Experts  on  Data 
Protection.  "Protection  of 
personal  data  used  for 
scientific  research  and 
statistics."  Final  activity 
report  from  the  European 
Committee  on  Legal 
Co-operation,  Council  of 
Europe,  Strasbourg,  July  22, 
1983,  paragraph  2.2. 
'^Ibid.  paragraph  4.2. 


required  for  carrying 
out  a  research  project, 
or  compliance  with 
other  safeguards  laid 
down  by  domestic  law, 
should  also  extend  to 
the  possibility  of  the 
personal  data  collected 
being  kept  after 
completion  of  the 
program. ' ' ^ 

and  further, 

'If,  on  completion  of 
the  project,  the 
personal  data  that  have 
been  used  are  not 
destroyed  or  rendered 
anonymous,  their 
deposit  with 
institutions  entrusted 
with  the  task  of 
keeping  data  and  in 
which  adequate  security 
measures  have  been 
taken  should  be 
encouraged. ' ' ' 

Altogether,  the  report  to 
the  Council  of  Europe  evinces  a 
positive  and  professional 
attitude  towards  the  needs  of 
researchers,  on  such  issues  as" 
access  to  data  and  conservation 
of  same,  on  which  scientific 
research  activity  now  depends 
heavily.  Now,  it  is  up  to  the 
national  inspectorates  to  show 
their  willingness  to  adhere  to 
these  principles  and  deal  with 
these  questions  as  well.  Data 
legislation  should  not  be 
limited  to  the  question  of 
protection  of  personal 
integrity,  but  rather  cover  the 
whole  spectrum  of  data 
protection  including  data 
archiving  and  data  access. 


'^Ibid.  paragraph  9.2. 
'*Ibid.  paragraph  9.4. 
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Confidentiality  and 
access:  legislative 
initiatives  in  the 
United  States 
government. 


Patricia  Aronsson  ' 
Director,  Documentation 
Standards  Division 
National  Archives  and  Records 
Service 


Introduction 


Information  specialists 
recognize  the  implications  of 
our  increased  reliance  upon 
automation.  The  conflicting 
demands  for  privacy  protection 


'  The  opinions  expressed  in 
this  article  are  those  of  the 
author  alone  and  do  not  reflect 
the  official  position  of  the 
National  Archives  and  Records 
Service,  nor  of  any  other 
federal  agency. 


and  access  clash  repeatedly. 
But,  this  conflict  will  not  be 
readily  resolved.  Recent 
initiatives  in  the  United 
States  government  reflect  the 
competing  demands  of  enhancing 
privacy  protection  and 
broadening  access  to 
information.  At  the  same  time 
that  the  United  States  Senate 
has  proposed  restricting  access 
under  the  Freedom  of 
Information  Act,  we  are  seeing 
more  computer  matching  programs 
than  ever  before.  While  the 
government  implemented  a  strong 
Privacy  Act,  we  failed  to 
recognize  the  international 
implications  of  that  effort. 

Privacy  legislation,  Freedom  of 
Information  Act  revisions,  and 
hearings  about  transborder  data 
flow  and  computer  matching 
represent  the  key  areas  where 
privacy  and  access 
considerations  are  evident. 
Congressional  concern  about 
personal  privacy  has  existed 
for  several  years;  in  1974,  the 
United  States  Congress  passed 
the  Privacy  Act.  The  House  of 
Representatives,  through 
hearings  in  1983,  demonstrated 
its  concern  about  the  oversight 
of  the  Act.  And  during  this 
past  Congress  (the  98th, 
1983-1984),  Representative 
Glenn  English  proposed  the 
creation  of  a  privacy 
protection  commission  to 
strengthen  the  implementation 
of  the  Act. 

The  Freedom  of  Information  Act 
continues  to  generate  interest 
and  activity.  In  1974,  Congress 
substantially  revised  the  Act. 
During  the  98th  Congress,  the 
Senate  passed  the  Freedom  of 
Information  Reform  Act  which 
significantly  modifies  several 
provisions  of  the  1974  Act.  The 
House  of  Representatives  held 
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hearings  on  the  proposed 
reforms  but  took  no  final 
action. 

In  recent  years,  the  United 
States  Congress  has 
demonstrated  its  concern  about 
the  impact  of  automation  on 
access  and  confidentiality 
through  several  hearings  it  has 
held.  There  have  been  a  few 
different  Congressional 
hearings  concerning  transborder 
data  flow.  And,  in  1982,  the 
Senate  held  hearings  on  the 
subject  of  computer  matching. 
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Privacy  Act 


The  Privacy  Act  of  1974  (5  USC 
552a)  represented  the  first 
attempt  by  the  United  States 
Congress  to  legislate  general 
government-wide  standards  for 
the  protection  of  individual 
privacy =  But,  the  passage  of 
this  Act  was  not  motivated  by  c 
concern  about  the  implications 
of  automation  for  privacy.  It 
is  more  likely  that  Congress 
passed  the  Privacy  Act  in 
reaction  to  the  Watergate 
episode  which  had  heightened 
national  concern  about 
executive  secrecy. 


Congress  recognized  the  need 
for  access  to  personal 
information  about  individuals, 
and  specified  exceptions  to  the 
Privacy  Act  requirement  that  an 
individual  must  authorize 
access  to  personally 
identifiable  records.  These 
several  exceptions  indicate 
that  Congress  was  aware  of  the 
need  to  provide  access  to 
information.  It  is  less  clear 
that  they  foresaw  the  need  to 
take  steps  to  ensure  full 
privacy  protection  for 
individuals.  The  legislation 
did  not  designate  a  central 
authority  for  the  adminstration 
and  oversight  of  Privacy  Act 
implementation.  This  has  proven 
to  be  a  significant  shortcoming 
and  has  been  the  focus  of 
recent  congressional  inquiries. 


In  1982, 
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As  an  outgrowth  of  these 
hearings.  Representative  Glenn 
English,  the  chairman  of  the 
subcommittee,  and  an  advocate 
of  privacy  protection,  proposed 
the  creation  of  a  Privacy 
Protection  Commission  which 
would  be  a  permanent  and 
independent  commission 
responsible  for  both  domestic 
and  international  privacy 
issues.  Representative  English 
described  the  proposed 
commission  as  followss 


Domestically,  the 
Commission  would  be 
assigned  an  oversight 
role  under  the  Privacy 
Act  of  1974.  The 
Commission  would 
develop  guidelines  and 
model  regulations, 
investigate  compliance 
with  the  Act,  and 
generally  oversee 
agency  Private  Act 
activities.  For 
international  privacy 
issues,  the  Commission 
would  assist  U.S. 
companies  doing 
business  abroad  to 
comply  with  foreign 
data  protection  laws, 
assist  in  the 
coordination  of  U.S. 
privacy  policies  with 
those  of  foreign 
nations,  accept 
complaints  and 
otherwise  consult  with 
foreign  data  protection 
agencies. ^ 

While  this  legislation 
certainly  would  centralize 
Privacy  Act  oversight,  it  does 
not  seem  likely  that  any  action 
on  its  creation  will  be  taken 
in  the  near  future.  In  the 
meantime,  the  courts  offer  the 
only  recourse  for  private 
citizens  who  feel  their  privacy 
has  been  violated  by  the 
federal  government. 

As  is  probably  apparent,  the 
federal  government  offers  only 
limited  privacy  protection.  A 
few  categories  of 
non-governmental  records  are 
the  subject  of  federal  privacy 
laws;  personally  identifiable 
records  gathered  by  credit 
bureaus  and  by  colleges  and 


universities  are  protected. 
State  and  local  government 
records  are,  for  the  most  part, 
excluded  from  coverage.  It  is 
important  to  note,  though,  that 
in  the  United  States,  each 
state  develops  its  own  privacy 
legislation  for  state  and  local 
records. 


Transborder  flow 


^Congressional  Record,  August 
2,  1983,  H6344  daily  edition. 


The  proposal  for  the  Privacy 
Protection  Commission  is  the 
most  recent  legislative 
initiative  which  addresses  the 
issue  of  transborder  data  flow. 
As  is  apparent  from 
Representative  English's 
statement,  though,  his 
legislation  grows  out  of  a 
concern  for  privacy.  Many 
people  in  the  United  States 
contend  that  the  major  issue 
surrounding  transborder  data 
flow  is  one  of  economics,  not 
privacy.  Both  the  House  of 
Representatives  and  the  Senate 
addressed  economic  concerns 
during  the  past  Congress.  Each 
house  received  legislation  to 
create  an  entity  to  oversee 
international 
telecommunications  and 
information;  the  Senate  bill 
proposed  a  White  House  office 
and  the  House  bill  proposed  an 
interagency  committee.  The 
recent  initiatives  in  the  area 
of  transborder  data  flow  stem, 
in  large  measure,  from  a 
recognition  that  the  United 
States  government  does  not  have 
an  agency  which  focuses  on  the 
international  exchange  of 
information. 

Several  reasons  make  it 
unlikely  that,  in  the  near 
future,  the  United  States 
Congress  will  pass  legislation 
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to  increase  the  government's 
role  in  transborder  data  flow. 
In  the  United  States,  there  is 
a  clear  separation  between  the 
public  and  private  sectors  and, 
in  addition,  the  first 
amendment  to  our  Constitution 
explicitly  limits  the 
government's  intrusion  into  the 
flow  of  information. 
Additionally,  the  United  States 
government  views  international 
regulation  of  data  as 
restrictive.  A  Senate  report 
written  in  1980  states: 
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Until  United  States  businesses 
are  significantly  hampered  by 
transborder  data  flow.  Congress 
probably  will  not  act. 


Computer  matching 


Computer  matching  programs 
present  significant  threats  to 
personal  privacy  and  yet  they 
have  proliferated  in  recent 


^"International 
Telecommunications  and 
Information  Policy:  Selected 
Issues  for  the  I980's",  Senate 
Report,  98-94,  p. 24 


years,  even  though  the  Privacy 
Act  seems  to  prohibit  them. 
Computer  matching  is  defined  as 
the  use  of  a  computer  to 
compare  data  in  a  Privacy  Act 
system  of  records  with  other 
data  for  purposes  of 
identifying  individuals  whose 
records  appear  in  more  than  one 
set  of  records.  Computer 
matching  programs  are  intended 
to  detect  and  curtail  fraud  or 
abuse  in  federal  assistance, 
loan,  or  benefit  programs. 

The  Inspector  General  Act  of 
1978  authorized  the  Inspectors 
General  to  request  and  obtain 
information  from  other  federal 
agencies  and  state  and  local 
governments  * .  As  a  result,  in 
1979,  the  Office  of  Management 
and  Budget  issued  guidelines 
for  agencies  acquiring 
computerized  data  files  for  use 
in  computer  matching  programs. 
These  guidelines,  which  were 
revised  in  1982,  require  that 

...the  source  agency 
should  require  the 
matching  entity  to 
agree  in  writing  to 
certain  conditions 
governing  the  use  of 
the  matching  file.^ 

Some  of  these  conditions  may 
state  that  the  matching  file 
will  remain  the  property  of  the 
source  agency,  that  the  file 
will  be  destroyed  or  returned 
at  the  end  of  the  project,  that 
the  file  will  be  used  only  for 
the  purposes  stated  in  the 
agreement,  and  the  file  will 


"  P.L.  97-252,  sections  6  (a) 
(3)  and  (b)  (l). 
^David  A.  Stockman,  Memorandum 
for  the  Executive  Departments 
and  establishments.  May  11, 
1982;  published  in  the  Federal 
Register,  May  19,  1982. 
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not  be  duplicated  either  within 
or  outside  the  receiving 
agency.  In  addition,  matching 
agencies  are  required  to 
publish  in  the  Federal  Register 
a  notice  describing  the 
matching  programs  and  to 
provide  a  copy  of  this  notice 
to  the  Congress  and  to  the 
Office  of  Management  and 
Budget.  These  procedures  are 
designed  to  alleviate  the 
potential  abuse  of  personal 
privacy  that  is  magnified  by 
the  increasing  use  of  computers 
for  the  collection  and 
maintenance  of  personal 
information. 

Computer  matching  programs  are 
becoming  more  widespread  in 
government.  In  1982,  the 
President's  Council  on 
Integrity  and  Efficiency 
initiated  the  Long  Term 
Computer  Matching  Project  to 
encourage  and  facilitate 
computer  matching.  In  July 
1982,  the  project,  which 
involves  all  Inspectors 
General,  published  its  first 
newsletter  and  reported  that 
the  inspectors  general  of  ten 
departments  and  agencies  were 
engaged  in  computer  matching 
efforts  of  sufficient 
significance  to  merit 
reporting.  It  is  likely  that 
the  newsletter  did  not  mention 
all  the  computer  matching 
programs  underway,  and  it  is 
just  as  likely  that  new 
matching  programs  have  been 
started  since  then.  While 
computer  matching  remains  a 
controversial  practice,  it 
seems  to  be  gaining  wider 
acceptance. 

Interestingly,  while  computer 
matching  has  become  more 
acceptable,  statistical 
research  has  been  severely 
curtailed  since  the  passage  in 


1976  of  the  Tax  Reform  Act 
which  places  strict 
restrictions  on  the  use  of 
individual  tax  returns. 


Freedom  of  Information  Act 

The  Freedom  of  Information  Act 
(FOIA)  ^  affects  privacy  and 
access  issues  in  a  number  of 
ways;  some  of  them  only 
tangentially.  Recent 
congressional  initiatives  to 
reform  the  FOIA  reflect  a 
growing  concern  about  access  to 
government  information.  One 
revision  prohibits  foreign 
nationals  from  acquiring 
information  under  the  Freedom 
of  Information  Act.  Another 
proposal  suggests  charging  a 
fair  value  fee  for  commercially 
valuable  information.  Yet 
another  modification  tightens 
access  to  informant 
information.'  As  mentioned 
earlier,  the  Senate  passed 
these  reforms  but  since  the 
house  of  Representatives  did 
not  act,  the  bill  expired  and 
will  have  to  be  re-introduced 
during  the  next  Congress.  One 
change  to  the  Freedom  of 
Information  Act  did,  however, 
become  law  this  year;  Central 
Intelligence  Agency  files  on 
intelligence  sources  and 
methods  have  been  exempted  from 
the  provisions  of  the  FOIA. 


The  impact  of  various 
definitions  on  privacy  and 
access 


^  5  use  552 

'S.  774,  98th  Congress. 
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Certainly  a  major  problem  we 
face  in  the  United  States 
government  is  determining  which 
materials  are  covered  by  which 
legislation.  The  multiple 
definitions  of  "record" 
complicate  the  protection  of 
privacy  in  the  U.S.  government. 
Both  the  Federal  Records  Act 
and  the  Privacy  Act  contain 
different  definitions  of  what 
constitutes  record  material. 
While  the  Freedom  of. 
Information  Act  does  not 
contain  an  explicit  definition 
of  records,  it  uses  phrases 
defined  in  each  of  the  other 
two  laws. 

These  multiple  definitions  of 
record  present  problems  to 
those  people  concerned  with 
privacy  protection  and  access. 
It  is  difficult  to  properly 
protect  information  or  to 
monitor  compliance  with  privacy 
protection  requirements  if  it 
is  not  clear  what  information 
is  covered. 


than  ever.  The  United  States 
Congress  is  beginning  to 
recognize  the  need  to  address 
the  problems  surrounding  the 
confidentiality  of  automated 
information.  And  it  is  likely 
that,  in  the  coming  years,  we 
will  see  a  great  deal  of 
congressional  activity  in  the 
area  of  privacy  and  access. 
But,  we  can  also  expect  that 
such  action  will  come  only  in 
reaction  to  particular 
problems.  We  are  likely  to  see 
a  series  of  discrete  pieces  of 
legislation,  each  designed  to 
address  a  specific  problem.  It 
would  be  unduly  optimistic  to 
expect  the  United  States 
Congress  to  develop  a 
comprehensive  and  coherent 
policy  concerning  the  increased 
use  of  automation  for  the 
collection  of  information. 
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Conclusion 


Federal  law  plays  a 
significant,  albeit  limited, 
role  in  the  protection  of 
privacy  in  the  United  States. 
Our  increased  reliance  on 
automated  information  makes 
such  protection  more  important 
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STEIN  ROKKAN  PRIZE 


..Announcing  third  ISSC  Stein  Rokkan  Prize  in  Comparative  R^se^rch... 


The  International  Social  Science  Council,  in  conjunction  with  the 
Conjunto  Universitario  Candido  Mendes  (Rio  de  Janeiro)  announces 
that  the  STEIN  ROKKAN  PRIZE  will  be  awarded  for  the  third  time  in 
the  Fall  of  1986. 

The  Prize  is  intended  to  crown  a  seminal  contribution  in 
comparative  social  science  research  written  in  English,  French  or 
German,  by  a  scholar  under  f ourty  years  of  age  on  31 st  December 
1 986.  It  can  be  a  manuscript  or  a  printed  book  or  collected  works 
in  each  case  published  after  1984. 

Four  copies  of  manuscripts  typed  double  space  or  of  printed  works 
shall  be  delivered  to  the  International  Social  Science  Council 
before  1 st  February  1 986,  together  with  a  formal  letter  of 
application  with  evidence  of  the  candidate's  age  attached. 

The  AWARD  shall  be  made  by  the  ISSC  General  Assembly  meeting  in 

the  Fall  of  1986  on  the  recommendation  of  the  ISSC  Executive 

Committee.  Its  decision  shall  be  final  and  not  subject  to  appeal 
or  revision. 

The  Prize  is  in  the  amount  of  U.S. $2000 .  00.  It  may  be  divided 
between  two  or  more  applicants,  should  it  be  found  difficult  to 
adjudicate  between  equally  valuable  works  submitted. 

For  further  enquiries,  please  write  to: 

The  Secretary  General 

International  Social  Science  Council 

UNESCO 

1 ,  rue  Miollis 

75015  Paris  -  France 
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ANNOUNCEMENT  and  CALL  FOR  PAPERS 

The  1985  Public  Health  Cc.fere.ve  on  Rftords  -..d  Statistics 
Washington,  D.C. 

August  13-15.  1985 

Thewe;  Health  Statistics:  They  Make  a  Difference 

Purpose:  The  National  Center  for  Health  Statistics  is  pleased  to  announce  the 
twentieth  biennial  conference  on  public  health  statistics.  Over  the  years  this 
'Conference  has  grown  to  where  It  Is  recognized  as  a  major  national  forum  for 
presenting  and  discussing  the  latest  advances  In  public  health  statistics.  The 
'1983  Conference  had  over  100  speakers  and  an  attendance  in  excess  of  1,000 
participants.  The  papers  that  were  presented  at  the  Conference  were  distributed 
widely  in  the  published  proceedings. 

This  year's  meeting  which  marks  the  25th  anniversary  of  NCHS  will  focus  on  the 
contributions  health  statistics  make  to  the  maintenance  and  improvement  of  the 
nation's  health.  This  Includes  such  diverse  areas  as  epidemiological  research, 
program  management,  provision  of  health  services,  planning  health  care  systems, 
toonitoring  health  status,  and  all  other  areas  where  health  statistics  are  a 
major  tool.  Papers  will  be  accepted  that  deal  with  projected  future  activities 
in  these  areas.  However,  papers  submitted  describing  past  activities  should 
show  their  clear  relevance  to  present  and  future  events. 

Papers  will  be  grouped  according  to  four  major  broad  tracks  that  will  run 
through  the  3-day  Conference.  These  are:  data  access  and  availability;  data 
analysis;  statistical  organizations  and  programs;  and  methodology  and 
technology.  Examples  of  each  track  are  as  follows,  however,  they  are  not 
Inclusive. 

Data  access  and  availability  includes  sources  of  data,  distribution,  media 
access,  confidentiality,  electronic  dissemination,  on-line  computer 
techniques. 

Data  analysis  includes  epidemiological  studies;  uses  of  data;  Impact  on 
legislation,  regulations,  and  budgets;  health  planning. 

Statistical  organizations  and  programs  include  the  planning, 
implementation,  and  operation  of  large  statistical  systems  by  public  and 
private  agencies  such  as  State  Centers  for  Health  Statistics,  Professional 
Review  Organizations,  professional  associations,  Medicaid  agencies.  Health 
Care  Financing  Administration,  and  other  Federal  agencies. 

Methodology  and  Technology  includes  new  methods  and  the  application  of  new 
technology  to  statistical  analysis,  survey  design,  data  collection,  data 
processing,  epidemiological  studies  and  disease  classification. 

Call  for  Papers;   Contributed  papers  will  be  accepted  for  any  session  of  the 

Conference  except  for  the  plenary  sessions.   Acceptable  papers  must  relate  to 

the  theme  of  the  Conference  and  to  one  of  the  four  tracks.  In  addition  papers 
may  be  Invited  on  specific  topics. 

Contributors  should  send  an  abstract  of  not  more  than  300  words  to 
Gail  F.  Fisher,  Ph.D,  Room  2-28,  Center  Building,  3700  East-West  Highway, 
Hyattsville,  Maryland,  20782  (phone  301-436-7050)  by  February  28,  1985. 

|The  authors  of  abstracts  selected  for  presentation  will  be  notified  by 
jApril  15,  1985  and  inforiped  of  all  technical  requirements  for  submission  of  the 
final  draft  which  will  be  required  prior  to  the  meeting.  Although  the  National 
Center  for  Health  Statistics  cannot  pay  an  honorarium  to  authors  of  either 
Invited  or  contributed  papers,  the  Center  will  pay  the  travel  and  per  d1em 
expenses  for  one  speaker  per  paper  to  attend  the  Conference. 
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lASSIST 


raBERSHIP  AND  SUBSCRIPTION  FEES 


The  International  Association  for  Social  Science  Information 
Services  and  Technology  (lASSIST)  is  a  professional  association 
of  individuals  who  are  engaged  in  the  acquisition,  processing, 
maintenance,  and  distribution  of  machine  readable  text  and/or 
numeric  social  science  data.  The  membership  includes  information 
systems  specialists,  data  base  librarians  or  administrators, 
archivists,  researchers,  programmers,  and  managers.  Their  range 
of  interests  encompasses  hardcopy  as  well  as  machine  readable 
data. 

Paid-up  members  enjoy  voting  rights  and  receive  the  lASSIST 
QUARTERLY.  They  also  benefit  from  reduced  fees  for  attendance 
at  regional  and  international  conferences  sponsored  by  lASSIST. 

Membership  fees  are: 

REGULAR  MEMBERSHIP:  $20  per  calendar  year 
STUDENT  MEMBERSHIP:  $10  per  calendar  year 

Institional  subscriptions  to  the  QUARTERLY  are  available,  but  do 
not  confer  voting  rights  or  other  membership  benefits. 


INSTITUTIONAL  SUBSCRIPTION; 


$35  per  calendar  year 
(includes  one  volume  of 
the  QUARTERLY) 


Ms.  Jacqueline  McGee 

The  Rand  Corporation 

1700  Main  Street 

Santa  Monica,  California 

U.S.A.    90406 

(213)  393-0411 


lASSIST 


MEMBERSHIP   APPLICATION 


Please  accept  my  application  for  membership  in  lASSIST: 

PHONE  (      ) 


NAME 

INSTITUTION  AFFILIATION 
MAILING  ADDRESS 


ZIP/POSTAL  CODE 


I  am  requesting: 


□  REGULAR  MEMBERSHIP   $20.00 

□  STUDENT  MEMBERSHIP  .  SI  0.0  0 

a   INSTITUTIONAL  MEMBERSHIP   $35.00 


MAKE  CHEC3<S  PAYABLE 
TO  I ASS  I  ST 


My  primary  interests   are: 

O      ARCHIVE  SERVICES/ADMINISTRATION 

□  DATA  PROCESSING/ DATA  MANAGEMENT 

□  RESEARCH  APPLICATIONS 

n   OTHER   ( SPEC  I  FY )  


O       PLEASE  INCLUDE  MY  NAME  IN  THE  lASSIST  MEMBERSHIP  DIRECTORY 


MS.  JACKIE  MCGEE 

THE  TREASURER,   lASSIST 

RAND  CORPORATION 

170  0  MAIN  STREET 

SANTA  MONICA,  CA   9  0  406 
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